Prepare Mica for public alpha distribution

[blas0]

Summary

• add the MIT license, release status, known limitations, and changelog
• add macOS CI for workspace compilation, CPU-only tests, clippy, and release builds
• use a separate empty entitlement profile for distribution bundles while retaining development entitlements as an explicit override
• document local build and run steps, including the ad-hoc signing and Metal-device requirements

Validation

• cargo test --workspace --no-run (passed)
• cargo test -p mica-core -p mica-atlas (passed: 216 tests)
• cargo clippy --workspace --all-targets (passed with existing warnings)
• cargo build --release -p mica-shell --bin mica (passed)
• ./bundle.sh release (passed; ad-hoc signature with distribution entitlements)
• bash -n bundle.sh (passed)
• plutil -lint resources/Mica.entitlements resources/Mica.distribution.entitlements (passed)
• git diff --check origin/main...HEAD (passed)

The full workspace test suite still requires a working Metal device. In this
environment it reports NoDevice for 19 GPU tests; the release gate is
documented in RELEASE.md.

Release boundary

This PR does not notarise or publish a downloadable app. Developer ID signing,
notarisation, and Gatekeeper validation remain release steps requiring the
owner's credentials and a supported clean Mac.